What is the CVSS score of CVE-2026-42822?

CVE-2026-42822 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Azure Local are affected by CVE-2026-42822?

A critical privilege escalation vulnerability in Microsoft Azure Local enables unauthenticated attackers to gain elevated system rights via network access, directly threatening hybrid cloud…. A patch is available.

How to fix or mitigate CVE-2026-42822?

Within 24 hours: Identify all systems running Azure Local and prioritize those in production hybrid-cloud environments. Within 7 days: Deploy Azure Local 2604.2.25645 patch to test systems, validate functionality, and plan production rollout schedule. Within 30 days: Complete patching of all production Azure Local instances and review authentication logs from the past 90 days for unauthorized access patterns.

Azure Local CVE-2026-42822

EUVD-2026-30787 CRITICAL

Improper Authentication (CWE-287)

2026-05-18 microsoft

GHSA-5ffh-v4jr-f65h

Authentication Bypass Microsoft

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 18:30 vuln.today

DescriptionCVE.org

Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Privilege elevation in Microsoft Azure Local Disconnected Operations allows unauthenticated network-based attackers to gain elevated rights via an improper authentication weakness (CWE-287). The flaw carries a maximum CVSS 10.0 score with scope change, and Microsoft has issued a patched build (Azure Local 2604.2.25645). No public exploit identified at time of analysis, but the trivial attack profile (AV:N/AC:L/PR:N/UI:N) makes this a top-priority fix for affected hybrid-cloud deployments.

Technical ContextAI

Azure Local (formerly Azure Stack HCI) is Microsoft's hyperconverged infrastructure platform that runs Azure services in customer data centers, often in disconnected or air-gapped environments. The 'Disconnected Operations' component handles authentication and resource management when the cluster cannot continuously reach the Azure control plane. CWE-287 (Improper Authentication) indicates the authentication mechanism in this component fails to correctly verify identity or trust claims, letting an attacker bypass identity validation entirely. The companion CPE for Azure Resource Manager suggests the bug crosses the boundary between local cluster control and the broader Azure ARM trust model, which is why CVSS scope is marked Changed (S:C).

RemediationAI

Vendor-released patch: Azure Local build 2604.2.25645 - upgrade all cluster nodes to this version or later via the standard Azure Local update channel as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42822. For the Azure Resource Manager side, Microsoft maintains the service centrally, so customers should verify the MSRC advisory for any tenant-side configuration steps. As a temporary compensating control until patching completes, restrict network reachability to Azure Local management endpoints to a hardened administrative subnet or jump-host, and audit recent authentication events on the cluster for anomalous principals; note that tightening management-plane network access can disrupt automation and remote support tooling, so coordinate with operations before applying ACL changes.